Sandboxie-Plus, an open source sandbox isolation software for Windows, has a stack-based buffer overflow vulnerability (CWE-121) in versions prior to 1.17.3. The vulnerability exists in the SbieSvc proxy service's GetRawInputDeviceInfoSlave handler, where an IPC request with cbSize set to 0 leaks up to 32KB of uninitialized stack memory, revealing return addresses and stack cookies that bypass ASLR and /GS protections. Additionally, a memcpy operation uses an attacker-controlled length without bounds checking, causing a stack buffer overflow. By chaining these two issues, a sandboxed process can execute a ROP chain to escalate privileges to SYSTEM, even from a Security Hardened Sandbox. Intel CET hardware shadow stacks prevent the ROP execution but do not mitigate the initial information leak. The vulnerability is addressed in Sandboxie-Plus version 1.17.3.

Successful exploitation allows a sandboxed process to escape the sandbox and escalate privileges to SYSTEM level on the affected Windows system. This can compromise system integrity and security by bypassing sandbox isolation and executing arbitrary code with high privileges. The information leak facilitates bypassing memory protection mechanisms, increasing the exploitability of the buffer overflow.

Upgrade Sandboxie-Plus to version 1.17.3 or later, where this vulnerability has been fixed. No other official remediation or temporary fixes are indicated. Systems running affected versions remain vulnerable until updated.